One Crome, each practice apart
Crome is one application serving several practices. Every record belongs to exactly one practice, directly or through the party it concerns, and every request works inside one practice: the signed-in person's own, or one that Crome's administrators are setting up or supporting, as described below. No view, search, export or report shows one practice's contracts or parties to another, and a link to another practice's record answers "not found". Each file is stored under a random key that only that practice's records hold. The code is shared; the data is not.
Where data is held
Application and database: Render, Frankfurt, Germany (European Union). PostgreSQL, encrypted at rest, with point-in-time recovery for the past 3 days.
Files (every version of a contract, our markups, signed copies, playbooks, and a party's documents on file, including those it sends with its questionnaire): Cloudflare R2 object storage, European Union jurisdiction, encrypted at rest.
Email: Resend, for invitations, password resets, and questionnaires and their reminders. An email carries a link, never a document, a contract term or an answer.
A nightly copy: each night the database and every file are copied to a separate Cloudflare R2 store in the European Union, encrypted at rest and reached with a key of its own. Each night's copy is kept for thirty days and then deleted.
All traffic between a browser and Crome, and between Crome and the outside services named on this page, is encrypted in transit.
Who can see what
Access is by named account; there are no shared passwords. Sign-in, password reset, this page and a technical status check are public. A questionnaire opens only from the link sent to the party's contact, and that link stops working once the questionnaire is returned.
Roles are Reviewer, Approver and Admin. Within a practice, only an Admin can add or deactivate users, change roles, upload playbooks, export the register or delete a contract. Passwords are stored as bcrypt hashes and must be at least twelve characters. Sessions end twelve hours after sign-in, and deactivating a user signs them out of every device at once.
Every change to a contract or a party is recorded in an append-only history with the person's name and the time. The history is never edited, and an Admin can export it at any time. Deleting a contract removes its history with it; one line recording the deletion, and who made it, stays with the party.
Crome's administrators set up each practice from Crome's own settings: they add it, invite its people, set their roles and load its playbooks. Each of these changes is recorded in the practice's history under the administrator's name, and every account in the practice, including any that Crome adds, is listed in its Settings under People, where its Admin can deactivate it.
For support, the practice's Admin opens a support window in Settings for a chosen number of days. While it is open, a Crome administrator can work in the practice as an Admin; the opening and every change made are recorded in the practice's history under that person's name, marked Crome, and the window closes itself.
The model
Reviews, markups, the first-page reading of a dropped contract and adverse media reports are produced by Anthropic's Claude models through Anthropic's API. Contract text and the practice's playbook positions are sent for the length of a request, and Anthropic may process them outside the UK and the European Union. Anthropic does not use API inputs or outputs to train its models. No other AI service is used, and nothing from one practice's contracts is used to improve reviews for another.
Zero data retention: pending. Until confirmed, Anthropic's standard short retention for trust and safety applies.
What is kept, and for how long
A contract's files, review, accepted terms and history are kept for as long as the practice uses Crome, whether the contract is live, signed or withdrawn. Nothing is removed automatically. An Admin can delete a contract at any time.
A party's questionnaire answers and the documents it sends are kept with the party for as long as the practice uses Crome. A document can be removed from the party's page at any time, and the removal is recorded.
Three checks send something about a party outside Crome, and only these. Sanctions screening compares names with the UK, EU, UN and US OFAC lists, which Crome downloads and reads on its own servers; nothing is sent to the list publishers. The Companies House lookup sends the company's name or number to Companies House, to find the company and fill in its registered name, address and status. The adverse media report sends the party's names and country, and the names of the directors and owners it has declared, to Anthropic, whose web search provider searches the press and public registers; every finding in the report is tied to its source, and a named person decides on it before anything in Crome changes. Nothing else is sent for any of these: no document, no contract and no other questionnaire answer.
When a practice leaves Crome, an Admin can export everything from Settings: the register, every file, the history, and each party's answers, documents and checks. Crome then deletes the practice's records and files when the practice asks in writing, and confirms in writing when it is done; the nightly copies that held them are deleted thirty days later.
What Crome does not do
It does not read a practice's documents for any purpose other than the work that practice asked for. It does not share, sell or combine a practice's contracts or positions. Any future benchmarking would use only de-identified, combined data, and only with the practice's written agreement. It does not send documents by email. It uses no service beyond those named on this page to hold or handle a practice's data, and its pages load nothing from outside Crome.
Incidents and contact
If Crome becomes aware of unauthorised access to a practice's records, it will tell that practice's Admin within seventy-two hours what is known, what was affected and what has been done. Cameron Payne, The Invitations Were Limited, cam@bluecrome.com.